Processing of personal data in accordance with the Regulation of the European Parliament and of the Council of the European Union
pursuant to Articles 13 to 22 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “General Data Protection Regulation” or “GDPR”) and Section 19 et seq. of Act No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts (hereinafter the “Personal Data Protection Act”).
Pursuant to Article 13 of the General Data Protection Regulation and Section 19 of the Personal Data Protection Act, the operator of the website https://holidayinn-zilina.sk/ (hereinafter also referred to as the “controller”) is obliged, where it obtains personal data relating to a data subject, to provide the data subject with the following information:
I. Contact details of the controller
- Business name: HI Kongres Hotel Žilina s.r.o.
- Address: Športová 2, 010 01 Žilina
- Company ID: 475 047 81
- Tax ID: 2023918974
- VAT ID: SK2023918974
- Contact: info@holidayinn-zilina.sk
- GDPR contact person: zo@eurotrading.sk
“We hereby inform you that supervision of personal data processing in our company is provided by EuroTRADING s.r.o. In accordance with Section 44 of Act No. 18/20128 Coll. and Article 37 of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL, it provides us with a data protection officer whom you may contact at zo@eurotrading.sk. Further information is available at www.eurotrading.sk/zo.”
II. Purpose of processing the data subject’s personal data
The controller processes the data subject’s personal data for the following purposes:
- Contacting the data subject
- Sending marketing offers
- Non-binding reservation of services
III. Scope of processing the data subject’s personal data
For the purposes stated above, the controller knowingly processes the following personal data provided by the data subject:
- First name
- Surname
- Email address
- Telephone number
Personal data that the controller processes from the data subject automatically:
- IP address
Other data processed (reservation guarantee):
- Arrival date
- Number of nights
- Company (where an invoice is issued to a company)
- Credit card number as a guarantee of the stay
IV. Retention period for the data subject’s personal data
The data subject’s personal data will be processed, collected, archived and securely stored for the period necessary for the purposes for which the personal data was processed or collected and until the statutory reason for any archiving ceases to apply, or for the duration of the consent granted for the processing of the data subject’s personal data. If the data subject requests erasure, all personal data will be permanently erased and related orders, if any, will be anonymised.
V. Method of obtaining, recording and securing the data subject’s personal data
We most often obtain the data subject’s personal data directly from the data subject, for example by means of a contact form. In such a case, providing personal data is voluntary and does not constitute a contractual or statutory obligation. The website controller is required to record all user requests relating to the retrieval, rectification and erasure of the data subject’s personal data. The controller uses modern technical and security mechanisms to protect the personal data being processed against unauthorised access or transfer, loss or destruction, or any other possible misuse. The controller does not transfer and does not intend to transfer the data subject’s personal data to a third country or an international organisation.
VI. Rights of the data subject relating to the processing of personal data
The General Data Protection Regulation and the Personal Data Protection Act lay down the general conditions for exercising the individual rights of the data subject. However, this does not automatically mean that every individual request will be granted by the controller, since exceptions may apply in a specific case or certain rights may be linked to particular conditions that are not met in every case. The controller will always assess a request concerning a specific right in light of the applicable legislation and available exceptions.
i. With the data subject’s consent, the controller may also process additional personal data of the data subject for a purpose other than that specified in Section II, or personal data other than that necessary to achieve a particular purpose under Section III. Where personal data processing is based on the data subject’s consent, the data subject has the right to withdraw that consent at any time. The data subject may or may not grant the controller consent to process personal data; refusal to grant consent has no adverse effect on the data subject. Withdrawal of consent to the processing of the data subject’s personal data does not affect the lawfulness of processing based on consent before its withdrawal. The data subject may withdraw consent in the same manner in which it was granted.
ii. The data subject has the right to ask the controller whether or not their personal data is being processed. The data subject has the right to request access to personal data concerning them. On the basis of this request, the controller will provide the data subject with confirmation containing information about the processing of their personal data. The controller is required to provide the data subject with the personal data it processes. For repeated provision of personal data requested by the data subject, the controller may charge a reasonable fee corresponding to the administrative costs. The controller is required to provide the personal data to the data subject in the manner requested.
iii. The data subject has the right to have personal data being processed kept accurate, up to date and complete. If the data subject’s personal data is out of date, the data subject has the right to ask the controller to rectify or complete it. The data subject has the right to have inaccurate personal data concerning them rectified by the controller without undue delay. Taking into account the purpose of processing, the data subject has the right to have incomplete personal data completed.
iv. The data subject has the right to object to the processing of their personal data and the right to ask the controller to erase personal data that is being processed unlawfully, beyond the purpose for which it was provided, or where the data subject withdraws consent.
v. The data subject has the right to object to the processing of their personal data carried out in the public interest or on the basis of the legitimate interests of the controller or a third party, including profiling. The controller may no longer process the personal data unless it demonstrates compelling legitimate grounds for processing which override the rights or interests of the data subject, or grounds for establishing, exercising or defending a legal claim.
vi. The data subject has the right to object to the processing of personal data concerning them for direct marketing purposes, including profiling to the extent that it is related to such direct marketing. If the data subject objects to the processing of personal data for direct marketing purposes, the controller may no longer process the personal data for such purposes.
vii. The data subject has the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which concerns them or similarly significantly affects them.
viii. The data subject has the right to have the controller erase personal data concerning them without undue delay. The data subject has the right to ask the controller to restrict processing where the data subject contests the accuracy of the personal data, for a period enabling the controller to verify its accuracy; the processing is unlawful and the data subject opposes erasure and requests restriction of its use instead; the controller no longer needs the personal data for processing purposes but the data subject requires it for establishing, exercising or defending a legal claim; or the data subject has objected to processing carried out in the public interest or on the basis of the legitimate interests of the controller or a third party, pending verification of whether the controller’s legitimate grounds override those of the data subject.
ix. Where processing has been restricted, with the exception of storage, the controller may process the personal data only with the data subject’s consent, for establishing, exercising or defending a legal claim, for the protection of persons, or for reasons of public interest. The controller is required to inform a data subject whose processing has been restricted before that restriction is lifted.
x. The data subject has the right to ask the controller to provide their personal data in an electronic form that enables it to be transferred to another company or a third party. The data subject has the right to receive personal data concerning them which they provided to the controller in a structured, commonly used and machine-readable format and has the right to transmit that personal data to another controller, where technically feasible and where the controller processes the personal data on the basis of the data subject’s consent or a contractual relationship.
xi. The data subject has the right to submit a petition to initiate personal data protection proceedings to determine whether the rights of natural persons have been infringed in the processing of their personal data or whether the Personal Data Protection Act or a special regulation has been breached, and, where deficiencies are found and it is justified and appropriate, to impose corrective measures or a fine for breach of that Act or of a special regulation in the area of personal data protection. Proceedings are initiated on the petition of the data subject or a person claiming to be directly affected in their rights established by that Act. The requirements for a petition by the data subject or by a person claiming to be directly affected in their rights, as well as the personal data protection proceedings themselves, are governed by Section 100 of Act No. 18/2018 Coll. on Personal Data Protection.
xii. Information provided by the controller on the basis of a right exercised by the data subject is provided free of charge. Where the data subject’s request is manifestly unfounded or excessive, in particular because of its repetitive character, the controller may charge a reasonable fee reflecting the administrative cost of providing the information or refuse to act on the request.
A data subject wishing to exercise the rights described above in relation to the processing of their personal data may contact the controller in writing by post or email. The controller will assess the request and inform the data subject of the outcome by the same means by which the request was submitted.
VII. Supervisory authority
Office for Personal Data Protection of the Slovak Republic
Hraničná 12
820 07 Bratislava 27
Slovak Republic
Company ID: 36064220
Email: statny.dozor@pdp.gov.sk
HI Kongres Hotel Žilina s.r.o., Športová 2, 010 01 Žilina, Company ID: 47 504 781
as the controller, in order to ensure fairness
and transparency towards data subjects, provides this notice to the data subject
on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “Regulation”) and Section 19 of Act No. 18/2018 Coll. of the National Council of the Slovak Republic on Personal Data Protection and on Amendments to Certain Acts
under the title
PERSONAL DATA PROTECTION POLICY
Purpose of personal data processing in accounting and tax records:
In the course of its activities, personal data is processed when accounting documents and related administrative matters are handled.
Categories of data subjects: natural persons – clients and employees
Personal data processed: first name, surname, title, permanent residence address, temporary residence address, telephone number, email address, date of birth, type and number of identity document, signature and the natural person’s bank account number
Legal basis for processing: Act No. 431/2002 Coll. on Accounting, as amended; Act No. 222/2004 Coll. on Value Added Tax, as amended; Act No. 40/1964 Coll., the Civil Code, as amended; Act No. 152/1994 Coll. on the Social Fund and on Amendments to Act No. 286/1992 Coll. on Income Taxes, as amended; and Act No. 311/2001 Coll., the Labour Code, as amended
Categories of recipients: the Social Insurance Agency, health insurance companies, the tax office, and entities entrusted by a special regulation with the power to decide on the rights and obligations of natural persons: courts and law enforcement authorities
Personal data is not transferred to third countries.
Personal data erasure periods:
| Accounting documents | 10 years |
No automated decision-making, including profiling, takes place.
In order to comply with the data minimisation principle, all personal data provided by you is a necessary statutory requirement for fulfilling the purpose of its processing.
Purpose of personal data processing in contract records:
In the course of its activities, personal data is processed where necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Categories of data subjects: natural persons – contracting parties
Personal data processed: first name, surname, title, permanent/temporary residence, the natural person’s account number, bank name, identity card number and data concerning the subject matter of the contract
Legal basis for processing: Section 13(1)(b) of Act No. 18/2018 Coll. on Personal Data Protection and on Amendments to Certain Acts
Categories of recipients: entities entrusted by a special regulation with the power to decide on the rights and obligations of natural persons: courts and law enforcement authorities
Personal data is not transferred to third countries.
Personal data erasure periods:
| Contracts | 10 years |
No automated decision-making, including profiling, takes place.
In order to comply with the data minimisation principle, all personal data provided by you is a necessary contractual requirement for fulfilling the purpose of its processing.
Purpose of personal data processing in records of incoming and outgoing mail and registry management:
In the course of its activities, personal data is processed when incoming and outgoing mail is registered and activities connected with registry management are carried out.
Categories of data subjects: natural persons – addressees and employees
Personal data processed: first name, surname, title, address, organisation name, job position, email address, and the subject and content of correspondence
Legal basis for processing: Act No. 395/2002 Coll. on Archives and Registries and on Amendments to Certain Acts, as amended, and Act No. 305/2013 Coll. on the Electronic Exercise of the Powers of Public Authorities and on Amendments to Certain Acts (the e-Government Act)
Categories of recipients: entities entrusted by a special regulation with the power to decide on the rights and obligations of natural persons: courts and law enforcement authorities
Personal data is not transferred to third countries.
Personal data erasure periods:
| Routine correspondence | 3 years |
No automated decision-making, including profiling, takes place.
In order to comply with the data minimisation principle, all personal data provided by you is a necessary statutory requirement for fulfilling the purpose of its processing.
Purpose of personal data processing in records of residents in a facility providing social services:
In the course of its activities, personal data is processed in records of social service recipients.
Categories of data subjects: social service recipients and their legal representatives
Personal data processed: first name, surname, title, address, date of birth, health insurance company, relatives’ addresses, pension amount, nationality, identity card and severe disability card numbers, and telephone number
Legal basis for processing: Act No. 448/2008 Coll. on Social Services and on Amendments to Act No. 455/1991 Coll. on Trade Licensing; Act No. 447/2008 Coll. on Cash Benefits to Compensate for Severe Disability and on Amendments to Certain Acts; Act No. 576/2004 Coll. on Healthcare and Services Related to the Provision of Healthcare and on Amendments to Certain Acts; and Act No. 580/2004 Coll. on Health Insurance and on Amendments to Act No. 95/2002 Coll. on Insurance and on Amendments to Certain Acts
Categories of recipients: Founder – Act No. 523/2004 Coll. on the Budgetary Rules of Public Administration and on Amendments to Certain Acts, Act No. 448/2008 Coll. on Social Services and on Amendments to Act No. 455/1991 Coll. on Trade Licensing, as amended; health insurance companies – Act No. 580/2004 Coll. on Health Insurance and on Amendments to Act No. 95/2002 Coll. on Insurance and on Amendments to Certain Acts; and entities entrusted by a special regulation with the power to decide on the rights and obligations of natural persons: courts and law enforcement authorities
Personal data is not transferred to third countries.
Personal data erasure periods:
| Personal files of recipients | 45 years |
No automated decision-making, including profiling, takes place.
In order to comply with the data minimisation principle, all personal data provided by you is a necessary statutory requirement for fulfilling the purpose of its processing.
Purpose of personal data processing – accommodated guests:
In the course of its activities, personal data is processed in records of hotel services and hotel guests, room reservations, personal data records in the hotel system’s guest database, and records of foreign guests.
Categories of data subjects: accommodated guests
Personal data processed: first name, surname, title, date and place of birth, nationality, permanent residence in the home country, purpose of travel to the Slovak Republic, passport number, visa type, number and validity, name and address of the accommodation facility in the Slovak Republic, accompanying children, and length of stay in Slovakia
Legal basis for processing: Act No. 40/1964 Coll., the Civil Code; Act No. 455/1991 Coll. on Trade Licensing; Act No. 595/2003 Coll. on Income Tax; Act No. 582/2004 Coll. on Local Taxes and the Local Fee for Municipal Waste and Minor Construction Waste, as amended; Act No. 222/2004 Coll. on Value Added Tax; Act No. 404/2011 Coll. on the Residence of Foreigners and on Amendments to Certain Acts; Act No. 431/2002 Coll. on Accounting; and Act No. 496/2008 Coll., the consolidated wording of Act No. 253/1998 Coll. on Reporting the Residence of Citizens of the Slovak Republic and the Register of Residents of the Slovak Republic, as amended
Categories of recipients: entities entrusted by a special regulation with the power to decide on the rights and obligations of natural persons: courts and law enforcement authorities
Personal data is not transferred to third countries.
Personal data erasure periods:
| Residence reports for foreign nationals | 5 years |
No automated decision-making, including profiling, takes place.
In order to comply with the data minimisation principle, all personal data provided by you is a necessary statutory requirement for fulfilling the purpose of its processing.
Purpose of personal data processing in diner records:
In the course of its activities, personal data is processed when records of diners are maintained.
Categories of data subjects: natural persons – diners
Personal data processed: first name, surname, title, address, class number or pupil number
Legal basis for processing: Act No. 597/2003 Coll. on the Financing of Primary Schools, Secondary Schools and School Facilities; Act No. 245/2008 Coll. on Education and Training (the Education Act) and on Amendments to Certain Acts, as amended; Decree No. 330/2009 Coll. of the Ministry of Education of the Slovak Republic on School Catering Facilities; Act No. 599/2003 Coll. on Assistance in Material Need; Act No. 431/2002 Coll. on Accounting; and a contractual relationship with the data subject
Categories of recipients: entities entrusted by a special regulation with the power to decide on the rights and obligations of natural persons: courts and law enforcement authorities
Personal data is not transferred to third countries.
Personal data erasure periods:
| Diners | 10 years |
No automated decision-making, including profiling, takes place.
In order to comply with the data minimisation principle, all personal data provided by you is a necessary statutory requirement for fulfilling the purpose of its processing.
Purpose of personal data processing in the visitor log:
In the course of its activities, personal data is processed to identify a natural person upon a one-time entry, record the movement of persons, and protect property and persons.
Categories of data subjects: natural persons – visitors
Personal data processed: first name, surname, identity card/service card number, and time of arrival and departure
Legal basis for processing: the controller’s legitimate interest
Categories of recipients: entities entrusted by a special regulation with the power to decide on the rights and obligations of natural persons: courts and law enforcement authorities
Personal data is not transferred to third countries.
Personal data erasure periods:
| Visitor log | 1 year |
No automated decision-making, including profiling, takes place.
In order to comply with the data minimisation principle, all personal data provided by you is a necessary statutory requirement for fulfilling the purpose of its processing.
Purpose of personal data processing in job applicant records:
In the course of its activities, personal data is processed when records of job applicants are maintained.
Categories of data subjects: natural persons – job applicants
Personal data processed: first name, surname, title, permanent residence, temporary residence, date of birth, telephone number, education, work experience, email address and other data contained in a curriculum vitae, cover letter and job application
Legal basis for processing: the data subject’s consent
Categories of recipients: entities entrusted by a special regulation with the power to decide on the rights and obligations of natural persons: courts and law enforcement authorities
Personal data is not transferred to third countries.
Personal data erasure periods:
| Curricula vitae | 1 year |
No automated decision-making, including profiling, takes place.
The data subject has the right to withdraw consent to the processing of personal data concerning them at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal; the data subject must be informed of this before consent is provided. The data subject may withdraw consent in the same manner in which it was granted.
Purpose of personal data processing in debt recovery records
In the course of its activities, personal data is processed for the purpose of debt recovery.
Categories of data subjects: natural persons – debtors
Personal data processed: first name, surname, title, permanent/temporary residence, identity card number and amount of debt
Legal basis for processing: contract, Act No. 40/1964 Coll., the Civil Code, and Act No. 233/1995 Coll. on Court Executors and Enforcement Activities (the Enforcement Code)
Categories of recipients: Executor – Act No. 233/1995 Coll. on Court Executors and Enforcement Activities (the Enforcement Code) and on Amendments to Certain Acts, as amended; courts and law enforcement authorities – processing is necessary for compliance with the controller’s statutory obligation pursuant to Act No. 301/2005 Coll., the Code of Criminal Procedure, as amended; Act No. 162/2015 Coll., the Code of Administrative Procedure, as amended by Act No. 88/2017 Coll.; Act No. 125/2016 Coll.; the Act on Certain Measures Related to the Adoption of the Code of Civil Contentious Procedure, the Code of Civil Non-contentious Procedure and the Code of Administrative Procedure and on Amendments to Certain Acts; and an authorised state authority – processing is necessary for compliance with the controller’s statutory obligation under the General Data Protection Regulation
and processors: JUDr. Vladimír Baťalík – lawyer, Š. Kukuru 14, 071 01 Michalovce, Company ID 35554975
Personal data is not transferred to third countries.
Personal data erasure periods:
| Debt recovery | 10 years |
No automated decision-making, including profiling, takes place.
In order to comply with the data minimisation principle, all personal data provided by you is a necessary statutory requirement for fulfilling the purpose of its processing.
Purpose of personal data processing in complaint records:
In the course of its activities, personal data is processed when records of persons are kept for the purpose of lodging a complaint.
Categories of data subjects: natural persons – clients
Personal data processed: first name, surname, title, residence, telephone number, email address and nature of the complaint
Legal basis for processing: Act No. 40/1964 Coll., the Civil Code, as amended; Act No. 250/2007 Coll. on Consumer Protection and on Amendments to Act No. 372/1990 Coll. of the Slovak National Council on Offences, as amended; and other related generally binding legal regulations
Categories of recipients: Slovak Trade Inspection – Act No. 128/2002 Coll. on State Control of the Internal Market in Consumer Protection Matters and on Amendments to Certain Acts; and entities entrusted by a special regulation with the power to decide on the rights and obligations of natural persons: courts and law enforcement authorities
Personal data is not transferred to third countries.
Personal data erasure periods:
| Complaints | 2 years |
No automated decision-making, including profiling, takes place.
In order to comply with the data minimisation principle, all personal data provided by you is a necessary statutory requirement for fulfilling the purpose of its processing.
Purpose of personal data processing in the CCTV information system:
In the course of its activities, personal data is processed for the purposes of protecting public order and security, detecting crime, and protecting health and property.
Categories of data subjects: persons present in an area monitored by the CCTV system
Personal data processed:
Legal basis for processing: the controller’s legitimate interest
Categories of recipients: courts and law enforcement authorities – processing is necessary for compliance with the controller’s statutory obligation pursuant to Act No. 301/2005 Coll., the Code of Criminal Procedure, as amended; Act No. 162/2015 Coll., the Code of Administrative Procedure, as amended by Act No. 88/2017 Coll.; Act No. 125/2016 Coll.; the Act on Certain Measures Related to the Adoption of the Code of Civil Contentious Procedure, the Code of Civil Non-contentious Procedure and the Code of Administrative Procedure and on Amendments to Certain Acts; and an authorised state authority – processing is necessary for compliance with the controller’s statutory obligation under the General Data Protection Regulation
Personal data is not transferred to third countries.
Personal data erasure periods:
| Video recording | 15 days |
No automated decision-making, including profiling, takes place.
In order to comply with the data minimisation principle, all personal data provided by you is a necessary statutory requirement for fulfilling the purpose of its processing.
Purpose of personal data processing in apartment building management:
In the course of its activities, personal data is processed in records of apartment owners for services and activities connected with apartment building management.
Categories of data subjects: owners of apartments and non-residential premises
Personal data processed: first name, surname, title, residence, date of birth, telephone number, email address and identity card number of owners, and the first name, surname, title, residence and date of birth of co-residents in the apartment building
Legal basis for processing: Act No. 70/2010 Coll. amending Act No. 182/1993 Coll. on the Ownership of Apartments and Non-residential Premises, as amended, and supplementing Act No. 118/1996 Coll. on the Protection of Deposits and on Amendments to Certain Acts; and Act No. 205/2014 Coll. amending Act No. 182/1993 Coll. on the Ownership of Apartments and Non-residential Premises, as amended
Categories of recipients: entities entrusted by a special regulation with the power to decide on the rights and obligations of natural persons: courts and law enforcement authorities
Personal data is not transferred to third countries.
Personal data erasure periods:
| Apartment building management | 10 years |
No automated decision-making, including profiling, takes place.
Disclosure: first name, surname, apartment number and amount in arrears on a notice board in the apartment building
Data subjects whose personal data is processed for specifically defined purposes may exercise the following rights:
The right to request access to their personal data – the right to rectification – the right to erasure – the right to restriction of processing – the right to object to processing – the right to data portability – the right to lodge a complaint with the supervisory authority, i.e. the Office for Personal Data Protection of the Slovak Republic
These rights of the data subject are specified in greater detail in Articles 15 to 21 of the Regulation. The data subject exercises these rights in accordance with the Regulation and other applicable legislation. The data subject may exercise their rights vis-à-vis the controller by means of a written request or electronically. If the data subject requests information orally, the information may be provided in that form provided that the data subject has proved their identity.
HI Kongres Hotel Žilina has adopted all reasonable personnel, organisational and technical measures to ensure the highest possible protection of your personal data and to minimise the risk of its misuse. In accordance with our obligation under Article 34 of the Regulation, we inform you as data subjects that if, as the controller, we breach the protection of your personal data in a manner likely to result in a high risk to the rights and freedoms of natural persons, we will notify you of that fact without undue delay.
Legislation and the related methods of processing your personal data may change. If we decide to update this policy, we will publish the changes on our website and inform you about them. Where a material change to this policy is to be made, or where required by law, we will inform you in advance. We ask you to read this policy carefully and to check it regularly when communicating with us further or using our website.
If you have any questions about the processing of your personal data, including the exercise of the rights stated above, you may contact our Data Protection Officer provided by EuroTRADING s.r.o. (www.eurotrading.sk) by email at zo@eurotrading.sk. We will properly investigate all your submissions and complaints and send you our response.
If you are not satisfied with our response or believe that we are processing your personal data unfairly or unlawfully, you may lodge a complaint with the supervisory authority, the Office for Personal Data Protection of the Slovak Republic, https://dataprotection.gov.sk, Hraničná 12, 820 07 Bratislava 27; telephone: +421 /2/ 3231 3214; email: statny.dozor@pdp.gov.sk